PAS-C01 Technology Practice Question
Exhibit
Refer to the exhibit. "Error: 'SAP' is not authorized to perform: ec2:DescribeInstances on resource: arn:aws:ec2:us-east-1:123456789012:instance/*"
An SAP administrator is trying to set up an AWS CLI script that queries EC2 instance metadata. The script runs on an EC2 instance with an IAM role attached. The IAM role has the following policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ec2:DescribeInstances",
"Resource": "*"
}
]
}What is the most likely cause of the error?
⚠ Common exam trap
Many candidates assume the IAM policy itself is the problem, when in fact the issue is the missing or mismatched instance profile that prevents credential retrieval from the instance metadata service.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The instance does not have an IAM instance profile associated, or the profile name does not match the role name.
The most likely cause is that the EC2 instance does not have an IAM instance profile associated, or the profile name does not match the role name. Without a properly attached instance profile, the AWS CLI cannot obtain temporary credentials from the instance metadata service (IMDS), so any API call—including ec2:DescribeInstances—will fail with an access denied or credential error, regardless of the IAM policy being correctly configured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The instance does not have an IAM instance profile associated, or the profile name does not match the role name.
Why this is correct
If the instance profile is not attached or is misconfigured, the role's permissions are not applied, causing the authorization error.
- ✗
The IAM policy does not specify a resource ARN.
Why it's wrong here
The policy uses "Resource": "*", which is valid for DescribeInstances.
- ✗
The IAM role does not have the ec2:DescribeInstances action allowed.
Why it's wrong here
The policy allows the action, but the error persists.
- ✗
The AWS CLI is not configured with the correct region.
Why it's wrong here
Region mismatch would cause a different error, not an authorization error.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PAS-C01 question from scratch — 1,616 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PAS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PAS-C01 exam.